[dpdk-dev,1/2] reorder: fix ready buffers not being nulled out

Message ID 1505228764-9738-1-git-send-email-pbhagavatula@caviumnetworks.com
State New
Delegated to: Thomas Monjalon
Headers show

Checks

Context Check Description
checkpatch success coding style OK
Intel-compilation success Compilation OK

Commit Message

Pavan Bhagavatula Sept. 12, 2017, 3:06 p.m.
The ready buffers should be set to NULL when drained else it might result
in double free (mempool put) when rte_reorder_free is called.

Fixes: b70b56032bff ("reorder: new library")

Signed-off-by: Pavan Nikhilesh <pbhagavatula@caviumnetworks.com>
---
 lib/librte_reorder/rte_reorder.c | 1 +
 1 file changed, 1 insertion(+)

Comments

Thomas Monjalon Oct. 11, 2017, 9:04 p.m.
12/09/2017 17:06, Pavan Nikhilesh:
> The ready buffers should be set to NULL when drained else it might result
> in double free (mempool put) when rte_reorder_free is called.
> 
> Fixes: b70b56032bff ("reorder: new library")
> 
> Signed-off-by: Pavan Nikhilesh <pbhagavatula@caviumnetworks.com>

Anyone to review, please?
Bruce Richardson Oct. 12, 2017, 8:32 a.m.
On Tue, Sep 12, 2017 at 08:36:03PM +0530, Pavan Nikhilesh wrote:
> The ready buffers should be set to NULL when drained else it might
> result in double free (mempool put) when rte_reorder_free is called.
> 
> Fixes: b70b56032bff ("reorder: new library")
> 
> Signed-off-by: Pavan Nikhilesh <pbhagavatula@caviumnetworks.com> ---
> lib/librte_reorder/rte_reorder.c | 1 + 1 file changed, 1 insertion(+)
> 
Rather than having an addition write for each entry going through the
reorder library, it should be possible to change free function so that
it only frees entries based on the index values.

In fact, a better solution to having reorder_free just blindly free the
mbufs would be to have reorder_free hand them back to the application,
or allow reorder_free to fail if the reorder buffer is non-empty. Making
such a change would be an ABI break, though.

/Bruce

Patch hide | download patch | download mbox

diff --git a/lib/librte_reorder/rte_reorder.c b/lib/librte_reorder/rte_reorder.c
index 010dff6..302eba6 100644
--- a/lib/librte_reorder/rte_reorder.c
+++ b/lib/librte_reorder/rte_reorder.c
@@ -392,6 +392,7 @@  rte_reorder_drain(struct rte_reorder_buffer *b, struct rte_mbuf **mbufs,
 	/* Try to fetch requested number of mbufs from ready buffer */
 	while ((drain_cnt < max_mbufs) && (ready_buf->tail != ready_buf->head)) {
 		mbufs[drain_cnt++] = ready_buf->entries[ready_buf->tail];
+		ready_buf->entries[ready_buf->tail] = NULL;
 		ready_buf->tail = (ready_buf->tail + 1) & ready_buf->mask;
 	}